From 30af63df15fc01ad7999c60a18503043c314f487 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Tue, 30 Jul 2024 16:32:02 +0000
Subject: [PATCH] Publish Advisories

GHSA-cp2c-x2pc-fph7
GHSA-cp2c-x2pc-fph7
---
 .../GHSA-cp2c-x2pc-fph7.json                  | 73 +++++++++++++++++++
 .../GHSA-cp2c-x2pc-fph7.json                  | 39 ----------
 2 files changed, 73 insertions(+), 39 deletions(-)
 create mode 100644 advisories/github-reviewed/2024/07/GHSA-cp2c-x2pc-fph7/GHSA-cp2c-x2pc-fph7.json
 delete mode 100644 advisories/unreviewed/2024/07/GHSA-cp2c-x2pc-fph7/GHSA-cp2c-x2pc-fph7.json

diff --git a/advisories/github-reviewed/2024/07/GHSA-cp2c-x2pc-fph7/GHSA-cp2c-x2pc-fph7.json b/advisories/github-reviewed/2024/07/GHSA-cp2c-x2pc-fph7/GHSA-cp2c-x2pc-fph7.json
new file mode 100644
index 00000000000..6b745332198
--- /dev/null
+++ b/advisories/github-reviewed/2024/07/GHSA-cp2c-x2pc-fph7/GHSA-cp2c-x2pc-fph7.json
@@ -0,0 +1,73 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-cp2c-x2pc-fph7",
+  "modified": "2024-07-30T16:30:35Z",
+  "published": "2024-07-30T09:32:05Z",
+  "aliases": [
+    "CVE-2023-48396"
+  ],
+  "summary": "Apache SeaTunnel Web Authentication vulnerability",
+  "details": "Web Authentication vulnerability in Apache SeaTunnel. Since the jwt key is hardcoded in the application, an attacker can forge any token to log in any user.\n\nAttacker can get secret key in /seatunnel-server/seatunnel-app/src/main/resources/application.yml and then create a token. This issue affects Apache SeaTunnel: 1.0.0.\n\nUsers are recommended to upgrade to version 1.0.1, which fixes the issue.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.apache.seatunnel:seatunnel-web"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.0.1"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48396"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/apache/seatunnel-web/commit/4a37ebfa4b57e177bf7857cf39a6dbdc00f75f78"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/apache/seatunnel"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.apache.org/thread/1tdxfjksx0vb9gtyt77wlr6rdcy1qwmw"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2024/07/30/1"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-290"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-07-30T16:30:35Z",
+    "nvd_published_at": "2024-07-30T09:15:02Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/07/GHSA-cp2c-x2pc-fph7/GHSA-cp2c-x2pc-fph7.json b/advisories/unreviewed/2024/07/GHSA-cp2c-x2pc-fph7/GHSA-cp2c-x2pc-fph7.json
deleted file mode 100644
index faa972a8a97..00000000000
--- a/advisories/unreviewed/2024/07/GHSA-cp2c-x2pc-fph7/GHSA-cp2c-x2pc-fph7.json
+++ /dev/null
@@ -1,39 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-cp2c-x2pc-fph7",
-  "modified": "2024-07-30T15:31:27Z",
-  "published": "2024-07-30T09:32:05Z",
-  "aliases": [
-    "CVE-2023-48396"
-  ],
-  "details": "Web Authentication vulnerability in Apache SeaTunnel. Since the jwt key is hardcoded in the application, an attacker can forge\nany token to log in any user.\n\nAttacker can get secret key in /seatunnel-server/seatunnel-app/src/main/resources/application.yml and then create a token.\nThis issue affects Apache SeaTunnel: 1.0.0.\n\nUsers are recommended to upgrade to version 1.0.1, which fixes the issue.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48396"
-    },
-    {
-      "type": "WEB",
-      "url": "https://lists.apache.org/thread/1tdxfjksx0vb9gtyt77wlr6rdcy1qwmw"
-    },
-    {
-      "type": "WEB",
-      "url": "http://www.openwall.com/lists/oss-security/2024/07/30/1"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-      "CWE-290"
-    ],
-    "severity": null,
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2024-07-30T09:15:02Z"
-  }
-}
\ No newline at end of file